Pages

Thursday, September 28, 2017

This graphic marks the latest installment of our Syria SITREP Map made possible through a partnership between the Institute for the Study of War and Syria Direct. This graphic depicts significant developments in the Syrian Civil War from September 14 - 27, 2017. The control of terrain represented on the graphic is accurate as of September 14, 2017.

Special credit to Sana Sekkarie of the Institute for the Study of War for the text of this Syria SITREP.

Wednesday, September 27, 2017

The
Russo-Iranian Coalition and U.S. Anti-ISIS Coalition hold divergent strategic
objectives that will undermine efforts to deconflict operations against ISIS in
Deir ez-Zour Province. The U.S. Anti-ISIS Coalition remains largely fixated on
its mission to defeat ISIS along the Middle Euphrates River Valley. No other
actors operating in the region share this prioritization. The Russo-Iranian
Coalition aims first and foremost to block the further expansion of the U.S.
Anti-ISIS Coalition in Eastern Syria. Russia and Iran view this expansion as a
long-term threat to Syrian President Bashar al-Assad as well as potential
ground lines of communication from Iran to Syria via Iraq.The Syrian Democratic Forces
(SDF) – an umbrella organization led by the Syrian Kurdish YPG that is the
preferred ground partner of the U.S. Anti-ISIS Coalition in Syria – also
retains its own objective to secure valuable terrain and resources as a future
bargaining chip in negotiations with Syrian President Bashar al-Assad. Both
sides intend to seize and exploit the valuable oil and natural gas fields of
Eastern Syria. These conflicting and overlapping objectives cannot be overcome
through deconfliction but rather stand to drive future direct confrontation
between the Russo-Iranian Coalition and U.S. Anti-ISIS Coalition along the
Euphrates River Valley.

The
U.S. Anti-ISIS Coalition and Russo-Iranian Coalition have entered a dangerous
escalation cycle near Deir ez-Zour City as of September 2017. Russia conducted overnight airstrikes targeting positions held by the SDF near
Deir ez-Zour City on September 16. The strike occurred less than one day after
the SDF-affiliated Deir ez-Zour Military Council asserted that its fighters would resist efforts by pro-regime
forces to cross the Euphrates River in Eastern Syria. Pro-regime forces later crossed the Euphrates River near Deir ez-Zour City on
September 18. Russia and Syria also reportedly conducted a new set of airstrikes and artillery shelling targeting the SDF on
September 25 after the SDF seized the critical Conoco Gas Plant on September 23. The U.S. Anti-ISIS Coalition has
repeatedly attempted to bolster deconfliction efforts with Russia – including
an unprecedented “face-to-face” meeting between high-ranking military officers to
share maps and intelligence on their positions in Eastern Syria. These efforts
nonetheless remain insufficient to address the strategic gulf between the two
rival coalitions.

The
Russo-Iranian Coalition will likely intensify its efforts to constrain and
block the U.S. Anti-ISIS Coalition in Eastern Syria. Pro-regime forces will
likely launch new cross-river operations to deny key oil fields and population
centers to the SDF along the Euphrates River Valley. Russia has already
established at least one fixed pontoon bridge across the Euphrates River near Deir
ez-Zour City. The Russo-Iranian Coalition will likely deploy additional
capabilities including anti-aircraft systems to Deir ez-Zour City to further constrain
the U.S. Anti-ISIS Coalition. The Russo-Iranian Coalition will also likely
bolster its efforts to coopt Iraq into a joint offensive against ISIS in Albu Kamal and
Al-Qa’im on the Syrian-Iraqi Border that excludes the U.S. Anti-ISIS Coalition.
This operation could include cross-border operations by Iraqi Shi’a Popular
Mobilization Units (PMU) backed by Iran. The Russo-Iranian Coalition and Iraqi
Security Forces have already begun synchronized ground operations to clear ISIS from
the Syrian-Iraqi Border on September 16. Russia and Iran stand to gain a
sustained forward presence to exert influence over Iraq and Jordan via Eastern
Syria. The mounting competition on the ground will also likely distract all
actors from their ostensible shared objective – the defeat of ISIS in Deir
ez-Zour Province. ISIS thus stands to retain at least limited safe haven for
the foreseeable future along the Middle Euphrates River Valley.

Sunday, September 17, 2017

Key Takeaway: ISIS’s attack campaign in Europe is expanding
despite ISIS’s losses of terrain and senior leadership in the Middle East and
North Africa. ISIS continues to plan, resource, and execute attacks from its
remaining safe havens in Syria, Iraq, and Libya. ISIS has successfully expanded
its coordinated attack campaign in Europe to target the UK and Spain. Rising
levels of ISIS-inspired attacks in Sweden and Finland may signal growing online
ISIS activity targeting vulnerable populations in those states and receptivity
among those populations to the ISIS message. Coordinated attack attempts could
follow. ISIS is sustaining its attack efforts in its initial target states of
France and Germany, meanwhile. ISIS’s activity in Belgium, also an initial
target state, is much lower, but the lack of ISIS attacks in Belgium does not
signal incapacity. ISIS may be using its networks in Belgium to support attack
cells elsewhere in Europe. ISIS also appears increasingly successful at
inspiring low-level attacks in Europe despite its territorial losses,
indicating its messaging is still resonant. ISIS’s campaign in Europe will
continue and may even increase despite its losses in Iraq and Syria.

Methodology

ISW has refined its methodology for assessing ISIS’s campaign in
Europe to leverage new published information such as details from the trials of
arrested ISIS members. ISW has curated its database of terrorist attacks in Europe,
ranging from clear instances of coordinated ISIS attacks to low-level attacks
that may have little to no direct ISIS involvement. This broad collection
aperture enables ISW to analyze the rising levels of Salafi-jihadi violence in
Europe that ISIS uses to justify and advertise its methodology and ideology.
This collection aperture also enables ISW to assess how much of the trend of
Salafi jihadi violence in Europe ISIS is actually commanding and controlling.

ISW sorts each attack into one of three categories: coordinated
ISIS attacks, inspired ISIS attacks, and unknown attacks. ISW also collects all
instances of attempted attacks, which also range from low-level would-be
attackers with unknown links to ISIS to complex, coordinated ISIS attack plots.
ISW maps both successful attacks and the arrests of thwarted attack cell
members to gain insight into where and how ISIS is attempting to penetrate
European security and to evaluate the success of ISIS’s campaign.The Appendix discusses ISW’s
methodology for assessing attempted attacks in more detail. The four categories
of attacks – both attempted and successful – that ISW has collected are:

Coordinated ISIS attacksare deliberate, planned attacks that ISIS has designed, resourced,
and supported from Syria, Iraq, or Libya. Senior ISIS leaders are often
involved in planning these attacks and training recruits. Coordinated ISIS
attacks vary in scale and complexity from relatively low-level attacks such as
vehicle rammings to sophisticated operations such as the 2015 Paris attacks.[1]ISW has
subcategorized each coordinated ISIS attack based on the type of attacker in
order to gain insight into how ISIS is executing its campaign. The attackers in
ISIS coordinated attacks to date have been returning ISIS foreign fighters,
ISIS refugee operatives, or local ISIS recruits who conducted or attempted to
conduct an attack while in contact with an ISIS “cyberplanner.” ISIS
cyberplanners are foreign fighters who conduct
online recruitment for ISIS, but also perform remote
logistical and other support functions by leveraging criminal and other
networks in Europe to enable ISIS recruits to access resources necessary for an
attack. US-led coalition airstrikes against the ISIS external attack network in
Syria and Iraq have focused on eliminating these nodes.[i]

Inspired ISIS attacksare attacks consistent with ISIS’s methodology and calls for
attacks in Europe. ISW assesses an attack to be inspired if the attacker(s)
have demonstrated pro-ISIS sympathies such as possessing ISIS propaganda or pledging
allegiance to ISIS online. Some of the attacks ISIS has inspired in Europe are
consistent with the US military’s doctrinal definition for a “complex attack.”[2] Many
of these attacks may actually be coordinated by ISIS cyberplanners, but ISW
assesses them to be inspired until or unless the involvement of a cyberplanner
has been adequately documented in publically available information.

Unknown attacksfit ISIS’s methodology and calls for “lone jihad” but have no
clear links to ISIS or in some cases even terrorism in publically available
reporting. The attackers may have been inspired by ISIS or other jihadist
groups such as al
Qaeda,
which has also sent operatives to
Europe, but ISW cannot assess such links with confidence. ISW categorizes these
attacks as “unknown” due to a lack of sufficient evidence of ISIS or al Qaeda
sympathies. ISW has included this data because these attacks support ISIS’s
claim of momentum and narrative of a growing global war between Sunni Muslim
populations and the majority non-Muslim world.

ISW updates its assessment of each attack when new information
emerges. The assessment presented below is based on publicly available
information as of September 14, 2017.

The Coordinated ISIS Attack Campaign in Europe

ISIS successfully expanded the scope of its coordinated attack
campaign in Europe to the United Kingdom and Spain in 2017.

The initial waves of ISIS’s coordinated attacks in Europe primarily
targeted France, Belgium, and Germany in 2014-2016. Returnee foreign fighters
conducted most of these attacks. ISW assesses that ISIS returnee foreign
fighters also tried and failed to conduct attacks in at least the UK, Spain, Morocco,
Italy, Albania, and Kosovo in that timeframe.

The EU Counterterrorism Chief stated on September 12, 2017 that
ISIS still has as many as 2,500 European foreign
fighters in
its ranks in Iraq and Syria and that at least 1,500 have returned to Europe to
date.ISIS’s European foreign fighter
population in Iraq and Syria will continue to provide the organization with
links to jihadist and criminal networks in Europe even if the foreign fighters
do not return to Europe. The foreign fighters that have already returned to
Europe provide ISIS with latent capability to conduct attacks in addition to
logistical and other support operations. ISIS is likely leveraging its foreign
fighter cadres to attack new states rather than execute coordinated attacks in
states where levels of ISIS-inspired attacks are rising.

ISIS’s success demonstrates that it continues to generate attack
capability faster than security services can disrupt new ISIS cells. In the UK,
an ISIS returnee
foreign fighterdetonated a suicide vest
(SVEST) at a concert venue in Manchester on May 22, 2017
in the first attack in the UK to date that fits ISW’s definition of a
coordinated attack. The attacker met with members of an ISIS external
operations cell in Libya prior to the attack, indicating that ISIS is leveraging command
and control outside of Syria and Iraq to support its European operations. In
Spain, members of an ISIS cellconducted two separate car-ramming attacks in Barcelona and Cambrilis as a
contingency operation after an explosion at the cell’s TATP factory killed its
leader and other members of the cell. TATP is an explosive that ISIS operatives
in Europe commonly use. The cell’s original plan was to conduct
a coordinated attack using TATP against the Sagrada Familia Church, a popular
tourist destination in Barcelona. The extent of
ISIS’s direct support to this attack cell is unclear, due in part to the death
of the cell’s leader
and numerous other cell members in the explosion of the TATP factory. Reports that
the cell’s leader traveled to
Belgium in
late 2016 could indicate that ISIS has a command-and-control node in Belgium that supported
the attack.

More coordinated ISIS attack plots in Europe are likely underway. Unconfirmed
reports indicate that ISIS’s external operations node in Libya has also dispatched foreign
fighters to Belgium and France in addition to the UK. It is possible that a
failed coordinated attack in Paris in 2017 was linked to the Libyan node. ISW
cannot confirm any coordinated attack cells in Belgium in 2017, but French and
Belgian police arrested one cross-bordercell with likely
links to ISIS in July 2017. This cell may have been planning attacks. The returnee
foreign fighters may also be using Belgium as a base for command and control and
logistical operations instead of a base for attacks, as the travel of the
Spanish cell’s leader to Belgium suggests. They may have joined a pre-existing
ISIS network in Brussels comprised of the initial wave of returnee foreign
fighters that reached Belgium before ISIS’s major successful attacks in Paris
and Brussels in November 2015 and March 2016, respectively.

Sustained ISIS attempts to conduct coordinated attacks in France
and Germany in 2017 indicate that ISIS continues to prioritize those countries.
ISIS’s Iraq-based French cyberplanner, Rachid Kassim, planned a coordinated
attack in Paris, France involving TATP before a
coalition airstrike killed him near Mosul, Iraq in February 2017. French police
successfully disrupted the attack and
arrested 2 cell members on September 6th, at least one of whom had
been in contact with Kassim. German police meanwhile disrupted what could have
been a coordinated ISIS attack attempt in Essen by a German foreign fighter in
March 2017 who was reportedly recruiting
people in the area to conduct an
attack.

Future ISIS success are also likely in the states that thwarted coordinated
ISIS plots from 2014- 2016, which include at least Italy, Albania, and Kosovo. ISIS’s
links to criminal networks in Italy may reduce the group's incentive to attack
there in the near term, since law enforcement responses to such attacks could disrupt
important support nodes. ISIS could also risk alienating business partners such
as elements of the Italian Mafia if it attacks Italy.
The anti-ISIS coalition has eliminated
numerous ISIS external operators in Syria tasked with managing ISIS’s attack
campaign in Albania and Kosovo in airstrikes in June 2017, meanwhile.
These strikes may have disrupted ISIS’s ability to generate attack cells in the
Balkans. ISIS may be attempting to leverage Balkan foreign fighters to conduct
attacks elsewhere in Europe, however. Italian police arrested a Kosovar cell including at
least one returnee ISIS foreign fighter in March 2017 that was planning an explosive
attack against the Rialto Bridge. Available
reporting does not confirm that ISIS provided direct support to this cell,
which could have been merely inspired by ISIS. ISW will update this assessment
as new details become available.

Coordinated ISIS attacks using refugees

ISIS’s coordinated attack campaign in Germany relies less on a
foreign fighter cadre than elsewhere in Europe. ISIS is also using recruited
and possibly trained refugees to conduct coordinated attacks in Germany.ISIS has conducted two successful coordinated
attacks in Germany using one returnee foreign fighter and one refugee operative
to date. The refugee was a Syrian who had reportedly fought with
ISIS before leaving for Europe in
2013. He detonated an
SVEST outside
a concert in Ansbach on
July 24, 2016. German police later discovered chemicals and other bomb-making
materials in his room at a refugee center in Germany. German authorities have reportedly
thwarted six coordinated ISIS attack attempts, involving three refugees, two returnees,
and one local who was likely in contact with an ISIS cyberplanner. Germany
authorities have reportedly thwarted an additional nine attacks that could
include attempted ISIS coordinated attacks, but for which adequate information
does not yet exist.

Refugees have conducted attacks in other countries, but ISW cannot
assess any coordinated ISIS involvement with confidence at the time of writing.
ISW’s assessment places ISIS-inspired attacks conducted by refugees into the
same category as all other instances of ISIS-inspired attacks. Future ISW
products will examine the trend of ISIS-inspired attacks in Europe in more
detail, to include when and where refugees have conducted such operations.

Attacks consistent with ISIS’s calls for “lone Jihad”

ISIS seeks to create momentum behind a campaign of attacks in
Europe that will require less direct input from ISIS over time. ISW assessed in November
2015 that ISIS’s goal in Europe was to provoke overreactions by European
governments that would alienate Muslim communities and radicalize them over
time. ISIS designed a campaign to inject violence into European societies in
order to jumpstart a campaign of low-level attacks against non-Muslim
populations in Europe that would further polarize European communities.

The scope and volume of low-level attacks that fit ISIS’s calls for
“lone jihad” in Europe nearly quadrupled in Europe from January 2014 to
September 2017. This trend could signal a growing resonance of ISIS’s messaging
to vulnerable populations despite ISIS’s territorial losses in Iraq and Syria. If
so, this trend would demonstrate ISIS success generating a campaign of violence
in Europe that requires progressively less direct input from ISIS to sustain.

It is still possible that ISIS cyberplanners or returnee foreign
fighters coordinated many of these attacks, however. Available information does
not enable ISW to assess these attacks to be coordinated at the time of writing.
Attacks consistent with the ISIS calls for “lone wolf” jihad expanded to Spain,[ii]
Italy,[iii]
Switzerland,[iv]and Finland[v] in
2017. The attacks in Finland and rising levels of similar attacks in Sweden are
the most likely to have been coordinated by ISIS, since they are in a new
theater. Finland raised its
threat level in
early 2017, which could signal intelligence indicating ISIS was actively
attempting to coordinate attacks. The chief of Sweden’s security service (SAPO)
warned in June 2017
that extremist activity was rising in multiple Swedish cities. Norway also raised its
threat level in early 2017, possibly indicating new ISIS
attack efforts. It is also possible that some of these attacks have been
inspired or enabled by al Qaeda rather than ISIS, but the available data does
not confirm al Qaeda links.

Conclusion

The success of anti-ISIS operations in Europe remains limited. ISIS continues to generate and inspire attacks on a scope and scale larger than European security services can handle. New countermeasures such as “vehicle mitigation barriers” can reduce the lethality of ISIS tactics but are unlikely to disrupt ISIS’s ability to inspire and recruit attackers. Anti-ISIS operations in Syria and Iraq have not severed the link between ISIS’s senior leadership and its operatives abroad, moreover. Coalition airstrikes in Iraq and Syria have eliminated many ISIS external operatives, but have not sufficiently degraded ISIS’s capability. ISIS also continues to use safe haven in Libya as a base from which to support attacks in Europe even after its loss of Sirte, demonstrating how removing ISIS from cities is insufficient to prevent ISIS from conducting attacks. The anti-ISIS coalition is unlikely to dismantle the global ISIS attack network without broadening the scope of anti-ISIS operations beyond a narrow terrain focus. ISIS can use safe-havens in rural and even desert areas to plan, coordinate, and support the conduct of attacks in the West.

It must also refocus on addressing the grievances and fears of vulnerable Sunni populations that make them vulnerable to ISIS messaging. The widespread perception that European states and the U.S. are aligned with Iran and the Assad regime against Sunni populations in Syria and Iraq, as well as the rise of anti-Muslim sentiments and perceived anti-Muslim policies in Europe and the U.S. will continue to fuel toleration of and limited but growing support for ISIS (and al Qaeda) attack operations in the West. ISIS is waging a social and informational campaign to gain support among Western populations—Western states will not be able to kill and arrest their way out of this problem.

Appendix: ISW methodology for analyzing attempted attacks

The first graphic in this report depicts the number of attacks and
attempted attacks per month in Europe from January 2014 to September 14, 2017.
The chart begins in January because it is the month when the first known ISIS
attack operative entered Europe after ISIS’s separation from al Qaeda’s Syrian
affiliate Jabhat al Nusra in mid-2013. French police arrested that operative,
named Abdelkader
Tliba,
thereby preventing what would have been the first coordinated ISIS attack in
Europe. ISW’s data set includes every such known attempted attack in Europe
since January 2014.

ISW’s data set most likely under-represents the number of thwarted
ISIS attack cells in Europe, which are the most difficult to discern from
openly available reporting. The “count” of attempted attacks per month in
Europe is the number of thwarted attack cells with proven links to ISIS or that
ISW assesses are possibly linked to ISIS based on openly available reporting. The
“count” is not estimate of the number of attacks that any given cell would have
conducted if not arrested. The actual number of attacks that ISIS has attempted
to conduct in Europe may be higher than the graphic in this report conveys,
therefore.

The “count” also does not measure the complexity of the thwarted
attack cell’s structure or geographic disposition. Some of the attack cells
included in this data set are individual attackers who were planning to conduct
a single operation based on instructions from an ISIS cyberplanner. Others are
larger networks of operatives spread between numerous safe houses in numerous
countries. Many fall somewhere in between, or reflect instances where European
security services arrested a cell before it had finalized an attack plan.

Comparing attempted vs successful attacks in Europe

The “count” for the successful attacks in Europe is the sum of the
locations at which successful attacks occurred. For example, the ISIS attack in
Paris November 2015 has a “count” of six. ISW has coded the attack data based
on each attack location because each separate attack location reflects a
separate successful attack operation that ISIS chose to coordinate and execute
simultaneously. This approach is in line with the methodologies used by U.S.
military forces in Iraq, Afghanistan and elsewhere, which tally each individual
kinetic event even when multiple attacks take place in a coordinated fashion
simultaneously, but in different locations.

The comparison of attempted attacks versus attacks provides a proxy
for assessing the success of ISIS’s campaign in Europe. The ratio favors ISIS,
as ISIS appears to be able to generate attacks faster than European security services can disrupt them.

ISW’s data set does not include instances of partial disruption of
an ISIS attack cell. An example of a partial disruption would be the arrest of
one of five suicide bombers that reduced the “count” of the successful attack
to the observed four attacks. This data
set is not an exhaustive accounting of all of the successes of European
security services against ISIS, therefore.

ISW has sorted attempted attacks into the same four categories as
successful attacks based on available evidence as of September 14, 2017:
attempted coordinated ISIS attacks, attempted ISIS-inspired attacks, and
unknown attempted attacks for which few details are publically available. ISW
routinely updates and re-evaluates the assessment of each attempted attack as
new details become available, such as new information about a given would-be
attacker’s links to ISIS cyberplanners. ISW will publish updates and refined
assessments as appropriate.

ISW’s Data Set vs. Official European Reporting

ISW’s data set includes more events and counts differently than official
European reports. For example, ISW’s data for 2016 includes eleven more attacks
in EU countries than the EU’s 2017 counterterrorism report and dozens more attempted attacks. The primary
reason for these differences is that ISW counts events that the EU member
states have not definitively ruled as terrorism. European states must discuss
terror attacks on the basis of definitive evidence and the proper application
of European laws. ISW’s approach enhances analysis of the ISIS campaign in
Europe by widening the aperture to include the entire set of events that likely
fit within the ISIS campaign even if insufficient evidence exists at present confidently
to designate each event as a terrorist attack. ISW also seeks to inform
analysis of the perceived trend of attacks in Europe, which ISIS and
other jihadist groups use to recruit even if based in part of false attribution
of some acts of violence, as this report explains.

ISW’s methodology to consider each attack location a separate
attack also contributes to differences between ISW and European reporting. The
EU report considers the March 2016 ISIS attack in Brussels to be a single
attack, for example; ISW counts it as three separate, coordinated attacks.

----------------------------------------

The authors would like to thank Ryan Rockwell for his tremendous research support to this product.

[1]ISW derived
this type of attack from the US military’s doctrinal definition of a
coordinated attacks which is: “an attack that exhibits deliberate planning
conducted by multiple hostile elements, against one or more targets from
multiple locations. A coordinated attack may involve any number of weapon
systems. [The] key difference between complex and coordinated is that a
coordinated attack requires the indication of insurgent long term planning.”

[2]“An attack
conducted by multiple hostile elements which employ at least two distinct
classes of weapon systems (i.e. indirect fire and direct fire, IED and surface
to air fire) against one or more targets.”

[i] For
example, the US killed ISIS’s
Albanian foreign fighter and attack
planner Lavdrim Muhaxeri in an airstrike on June 7,
2017 near Mayadin, Syria.

[ii] An attack consistent with
ISIS’s calls for “lone jihad” targeted a
Spanish-Moroccan border post on July 25,
2017 before the ISIS cell in Barcelona conducted its attacks.

[iii] The first attack consistent with
ISIS’s calls for “lone jihad” to target Italy occurred
on May 18, 2017. ISW assesses the attacker was inspired by ISIS.